Ameris Bancorp (ABCB) Risk Analysis

We compute our income tax provision based on enacted tax rates in the jurisdictions in which we operate. Any change in enacted tax laws, rules or regulatory or judicial interpretations, or any change in the pronouncements relating to accounting for income taxes, could adversely affect our effective tax rate, tax payments and results of operations. For example, in July 2025, the One Big Beautiful Bill Act ("OBBBA") was signed into law, introducing significant tax changes. The OBBBA extends or makes permanent various tax provisions that were originally enacted in the 2017 Tax Cuts and Jobs Act and were set to expire at the end of 2025. The OBBBA features modified versions of individual and business tax relief proposals, and other new tax relief measures. In addition, it includes various revenue-raising measures, including changes to certain Inflation Reduction Act clean energy tax credits and various limits on business and individual tax deductions, that are intended to offset part of the cost of the legislation. We are currently evaluating the impact of the OBBBA on our business and consolidated financial statements. Additionally, the taxing authorities in the jurisdictions in which we operate may challenge our tax positions, which could increase our effective tax rate and harm our financial position and results of operations. We are also subject to audit and review by U.S. federal and state tax authorities. Any adverse outcome of such a review or audit could have a negative effect on our financial position and results of operations. In addition, changes in enacted tax laws, such as adoption of a lower income tax rate in any of the jurisdictions in which we operate, could impact our ability to obtain the future tax benefits represented by our deferred tax assets. Also, the determination of our provision for income taxes and other liabilities requires significant judgment by management. Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded in our financial statements and could have a material adverse effect on our financial results in the period or periods for which such determination is made.

We operate in a highly competitive financial services environment, with our profitability dependent upon our ability to compete successfully based on such factors as brand recognition and reputation, client relationships, product offerings, pricing, convenience, technology, accessibility and customer service. We face significant pricing competition for loans and deposits. For us to successfully compete for borrowers and depositors, we may be required to offer loan and deposit products on terms that are less favorable to us, such as lower interest rates on loans and higher interest rates on deposits. Certain competitors are larger and may have more resources than we do. We face competition in our regional market areas from other commercial banks, savings and loan associations, credit unions, internet banks, mortgage companies, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, fintechs and other financial intermediaries that offer similar services. Some of our non-bank competitors are not subject to the same extensive regulations that govern us or the Bank and may have greater flexibility in competing for business. Another competitive factor is that the financial services market, including banking services, is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The widespread adoption of new and emerging technologies, such as artificial intelligence and quantum computing, have the potential to further intensify competition and accelerate disruption in the financial services market. Our future success may depend, in part, on our ability to use technology competitively to provide products and services that provide convenience to customers and create additional efficiencies in our operations.

In recent years, fraud risk has continued to be a significant risk for us and for all banks. Card fraud and deposit fraud (such as check kiting and wire fraud) continue to be significant sources of fraud attempts and losses in our consumer banking business. Moreover, our commercial clients have experienced increased levels of financial fraud risk as well, often requiring our involvement and assistance because of our banking relationship with these clients. The methods used to perpetrate and combat fraud continue to evolve as technology changes and more tools for access to financial services emerge, such as real-time payments. In addition to cybersecurity risks, new techniques have made it easier for bad actors to obtain and use client personal information, mimic signatures and otherwise create false documents that look genuine. Fraud schemes are broad and can include debit card/credit card fraud, check fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, impersonation of our clients through the use of falsified or stolen credentials, employee fraud, information fraud and other malfeasance. Criminals are regularly turning to new sources to steal personally identifiable information in order to impersonate our clients to commit fraud. Our regulators require us to report fraud promptly, and regulators often advise banks of new schemes to enable the entire industry to adapt as quickly as possible. However, some level of fraud loss is unavoidable, and the risk of loss cannot be eliminated. Our anti-fraud actions are both preventative (anticipating lines of attack, educating employees and clients, and implementing operational changes) and responsive (remediating attacks). We have established policies, processes and procedures designed to identify, measure, monitor, mitigate, report and analyze these risks. We continue to invest in systems, resources and controls designed to detect and prevent fraud. There are inherent limitations, however, to risk management strategies, systems and controls as they may exist, or develop in the future. We may not appropriately anticipate, monitor or identify these risks. If our risk management framework proves ineffective, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems, and we may be subject to potential claims from third parties and government agencies. We may also suffer reputational damage. Any of these consequences could adversely affect our business, financial condition or results of operations.

We are dependent on our reputation within our market area, as a trusted and responsible financial services company, for all aspects of our business, with customers, employees, vendors, third-party service providers and others with whom we conduct business. Negative public opinion about the financial services industry generally, including with respect to the types of banking products and services we provide, or us specifically could adversely affect our reputation and our ability to keep and attract customers and employees. In addition, adverse reputational impacts on third parties with whom we have important relationships may also adversely impact our reputation. Our actual or perceived failure to address various issues could give rise to negative public opinion and reputational risk that could cause harm to us and our business prospects. These issues include, but are not limited to, legal and regulatory requirements; properly maintaining customer and employee personal information; record keeping; money-laundering; sales and trading practices; ethical issues; appropriately addressing potential conflicts of interest; and the proper identification of legal, credit, liquidity, market and other risks inherent in our products. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions and legal risks, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties and cause us to incur related costs and expenses. In addition, the proliferation of social media websites utilized by us and other third parties, as well as the personal use of social media by our employees and others, including personal blogs and social network profiles, also may increase the risk that negative, inappropriate or unauthorized information may be posted or released publicly that could harm our reputation or have other negative consequences, including as a result of our employees interacting with our customers in an unauthorized manner in various social media outlets. Any damage to our reputation could affect our ability to retain and develop the business relationships necessary to conduct business, which in turn could negatively impact our financial condition, results of operations and the market price of our Common Stock.

Natural disasters such as hurricanes, tropical storms, floods, wildfires, extreme weather conditions and other acts of nature, geopolitical events such as those involving civil unrest, changes in government regimes, terrorism or military conflict, pandemics and other public health crises, and other catastrophic events could adversely affect our business operations and those of our customers, counterparties and service providers, and cause substantial damage and loss to real and personal property, including damage to or destruction of mortgaged properties or our own banking facilities and offices. Natural disasters, geopolitical events, public health crises and other catastrophic events, or concerns about the occurrence of any such events, could impair our borrowers' ability to service their loans, decrease the level and duration of deposits by customers, erode the value of loan collateral, including mortgaged properties, result in an increase in the amount of our non-performing loans and a higher level of non-performing assets, including real estate owned, net charge-offs and provision for loan losses, lead to other operational difficulties and impair our ability to manage our business, which could materially and adversely affect our business, financial condition, results of operations and the value of our common stock. We also could be adversely affected if our key personnel or a significant number of our employees were to become unavailable due to a public health crisis (such as an outbreak of a contagious disease), natural disaster, war, act of terrorism, accident or other reason. Additionally, financial markets may be adversely affected by the current or anticipated impact of military conflict, acts of terrorism or other geopolitical events.

Our Common Stock is listed and traded on the New York Stock Exchange (the "NYSE"). If the liquidity of the NYSE market should fail to operate at a time when we may seek to raise equity capital, or if conditions in the capital markets are adverse, we may be constrained in raising capital. Downgrades in the opinions of the analysts that follow our Company may cause our stock price to fall and significantly limit our ability to access the markets for additional capital. Should these risks materialize, our ability to further expand our operations through internal growth or acquisition may be limited.

In the normal course of business, we collect, process and retain sensitive and confidential information regarding our customers. We also have arrangements in place with other third parties through which we share and receive information about their customers who are or may become our customers. Although we devote significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs, our facilities and systems, and those of third-party service providers, are vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors or other similar events. Additionally, information security may be adversely affected by the current or anticipated impact of military conflicts, acts of terrorism or other geopolitical events. Information security risks for financial institutions like us continue to increase in part because of new technologies, the use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others. In addition to cyberattacks or other security breaches involving the theft of sensitive and confidential information, hackers continue to engage in attacks against financial institutions. These attacks include denial of service attacks designed to disrupt external customer facing services and ransomware attacks designed to deny organizations access to key internal resources or systems. We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources. We employ detection and response mechanisms designed to contain and mitigate security incidents, but early detection may be thwarted by sophisticated attacks and malware designed to avoid detection. Notwithstanding the strength of defensive measures, cybersecurity threats and the tactics, techniques and procedures used in cyberattacks change, develop and evolve rapidly and continuously, including from emerging technologies, such as artificial intelligence, which may be used to enhance the tactics, techniques and procedures described above and facilitate new cyber threats. We rely heavily on communications and information systems to conduct our business. Accordingly, we also face risks related to cyberattacks and other security breaches in connection with our own and third-party systems, processes and data, including credit and debit card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties, including merchant acquiring banks, payment processors, payment card networks (e.g., Visa, Mastercard) and our processors. Some of these parties have in the past been the target of security breaches and cyberattacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyberattacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. While we conduct security reviews on these third parties, we cannot be sure that their information security protocols are sufficient to withstand a cyberattack or other security breach. The access by unauthorized persons to, or the improper disclosure by us of, confidential information regarding our customers or our own proprietary information, software, methodologies and business secrets could result in significant legal and financial exposure, supervisory liability, damage to our reputation or a loss of confidence in the security of our systems, products and services, which could have a material adverse effect on our business, financial condition or results of operations. In addition, our industry continues to experience well-publicized attacks or breaches affecting others in our industry that have heightened concern by consumers generally about the security of using credit and debit cards, which have caused some consumers, including our customers, to use our credit and debit cards less in favor of alternative methods of payment and has led to increased regulatory focus on, and potentially new regulations relating to, these methods. Further cyberattacks or other breaches in the future, whether affecting us or others, could intensify consumer concern and regulatory focus and result in reduced use of our cards, increased costs and regulatory penalties, all of which could have a material adverse effect on our business. To the extent we are involved in any future cyberattacks or other breaches, our brand and reputation could be affected, which could also have a material adverse effect on our business, financial condition or results of operations.

Our success depends, in large part, on our ability to attract and retain competent, experienced people. Our strategic goals in particular require that we be able to attract qualified and experienced retail and commercial banking officers, mortgage loan officers and lenders in our various business lines, both in our existing markets and those markets in which we may want to expand, who share our relationship banking philosophy and have those customer relationships that will allow us to grow successfully. We also need to attract and retain qualified and experienced technology, risk and back-office personnel to operate our business. Many of our competitors are pursuing the same relationship banking strategy in our markets and are looking to hire and retain qualified technology, risk and back-office personnel, which increases the competition to identify, hire and retain talented employees. In addition, the loss or replacement of key employees and the regular integration of newly hired employees creates an additional risk to the Company's culture. If we fail to consider and appropriately account for these challenges, we will face increased difficulty in creating and maintaining a cohesive culture. Our failure to successfully compete for experienced, qualified employees or to maintain our culture and attractive working environment may have an adverse effect on our ability to meet our financial goals and thus adversely affect our future results of operations.

Third parties provide key components of our business operations such as our core technology infrastructure, cloud-based operations, data processing, recording and monitoring transactions, online banking interfaces and services, internet connections and network access. While we have ongoing programs to review third-party vendors and assess risk, we do not control their actions. Any problems caused by these third parties, including those resulting from disruptions in communication services provided by a vendor, issues at a third-party vendor of a vendor, failure of a vendor to handle current or higher volumes, cyberattacks and security breaches at a vendor, failure of a vendor to provide services for any reason, or poor performance of services, could adversely affect our ability to deliver products and services to our clients and otherwise conduct our business. Financial or operational difficulties of a third-party vendor could also hurt our operations if those difficulties interfere with the vendor's ability to serve us. Furthermore, our vendors could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. Replacing these third-party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable inherent risk to our business operations. Our digital services growth initiatives, core technology upgrades and digital asset initiatives constitute specific increases in third-party risk as such initiatives are distinctly dependent on the performance of our third-party partners.